logoalt Hacker News

richrichardsson • today at 10:41 AM • 3 replies • view on HN

How legit is this? Seems low on details.

I don't use Cursor or the VSCode extension, but know plenty in our organisation who use the latter. How worried should we be?


Replies

abirch • today at 11:19 AM

1shooner posted this link: https://www.binance.com/en/square/post/10-30-2026-claude-cod... this was not the official extension. Supply Chain is very important, please only use official builds. From the link above:

A malicious version of Anthropic’s Claude Code VS Code extension, version 2.1.313, was published to the Open VSX registry on Oct. 30. According to ChainCatcher, security researcher Paul McCarty, known as 6mile, described the finding in a post on the OpenSource Malware blog. Researchers confirmed the analyzed Open VSX release was malicious and submitted a threat report about the same version on Microsoft’s VS Code Marketplace as a precaution.

➕ show 1 reply
hoppp • today at 1:00 PM

Better be safe and check your dev environment if you use it.

feross • today at 9:13 PM

[flagged]